# Using different Index names in Output logstash
**URL:** https://discuss.elastic.co/t/using-different-index-names-in-output-logstash/273364
**Category:** Logstash
**Created:** [May 19, 2021, 6:16am UTC](https://discuss.elastic.co/t/using-different-index-names-in-output-logstash/273364 "2021-05-19T06:16:50Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@Saravana37](https://discuss.elastic.co/u/Saravana37)
#### Post date: [May 19, 2021, 6:16am UTC](https://discuss.elastic.co/t/using-different-index-names-in-output-logstash/273364/1 "2021-05-19T06:16:50Z")
Hello All ,
I want to re-use the config lines in output logstash as shown below. I am using if condition but is throwing some error. Please help me out.
```
output {
elasticsearch
{
hosts => ["https://XXXXXnet:8200"]
user => "${es_usr}"
password => "${es_pwd}"
if "RequestRouter" in [source] and "VAGAPIEMEA" in [InterfaceName]
{
index => "prodsrvrlog-reqrouter-vagapi-%{log_day}"
}
else if "RequestRouter" in [source]
{
index => "prodsrvrlog-reqrouter-%{log_day}"
}
else if "FleetboardListener" in [source]
{
index => "api_fleet_list-%{log_day}"
}
else if "SComm" in [source]
{
index => "scomm-%{log_day}"
}
else if "metric" in [fields][type]
{
index => "metricbeat-%{+YYYY.MM.dd}"
}
else if "PROD" in [fields][env]
{
index => "prodsrvrlog-%{log_day}"
}
else
{
index => "otherdata-%{+YYYY.MM.dd}"
}
ssl => true
ssl_certificate_verification => false
cacert => "E:\ELK\ODForESearch\config\chain.pem"
ilm_enabled => false
document_id => "%{[fingerprint]}"
}
```
---
### Author:  [@ylasri](https://discuss.elastic.co/u/ylasri)
#### Post date: [May 19, 2021, 7:35am UTC](https://discuss.elastic.co/t/using-different-index-names-in-output-logstash/273364/2 "2021-05-19T07:35:31Z")
Condition should be applied to all ouput block like this
```auto
output {
if "RequestRouter" in [source] and "VAGAPIEMEA" in [InterfaceName]
elasticsearch
{
hosts => ["https://XXXXXnet:8200"]
user => "${es_usr}"
password => "${es_pwd}"
ssl => true
ssl_certificate_verification => false
cacert => "E:\ELK\ODForESearch\config\chain.pem"
ilm_enabled => false
document_id => "%{[fingerprint]}"
index => "prodsrvrlog-reqrouter-vagapi-%{log_day}"
}
else if "RequestRouter" in [source]
elasticsearch
{
hosts => ["https://XXXXXnet:8200"]
user => "${es_usr}"
password => "${es_pwd}"
ssl => true
ssl_certificate_verification => false
cacert => "E:\ELK\ODForESearch\config\chain.pem"
ilm_enabled => false
document_id => "%{[fingerprint]}"
index => "prodsrvrlog-reqrouter-%{log_day}"
}
....
}
```
---
### Author:  [@Saravana37](https://discuss.elastic.co/u/Saravana37)
#### Post date: [May 19, 2021, 7:50am UTC](https://discuss.elastic.co/t/using-different-index-names-in-output-logstash/273364/3 "2021-05-19T07:50:41Z")
Hello @ylasri ,
Thanks for your response. Then the no of lines in the config increasing . Can't we use index name in the mutate filter like below ?
```
if "RequestRouter" in [source] and "VAGAPIEMEA" in [InterfaceName]
{
mutate {
add_field => {
"myindex" => "prodsrvrlog-reqrouter-vagapi-%{log_day}"
}
}
```
---
### Author:  [@ylasri](https://discuss.elastic.co/u/ylasri)
#### Post date: [May 19, 2021, 7:53am UTC](https://discuss.elastic.co/t/using-different-index-names-in-output-logstash/273364/4 "2021-05-19T07:53:04Z")
Yes, this the best way, add a metadata field to hold index name and avoid index it in doucments
Check an example here
> **[Elasticsearch output plugin | Logstash Reference \[7.12\] | Elastic](https://www.elastic.co/guide/en/logstash/current/plugins-outputs-elasticsearch.html#_writing_to_different_indices_best_practices)**
---
### Author:  [@Saravana37](https://discuss.elastic.co/u/Saravana37)
#### Post date: [May 19, 2021, 8:21am UTC](https://discuss.elastic.co/t/using-different-index-names-in-output-logstash/273364/5 "2021-05-19T08:21:08Z")
Sure @ylasri ,
I will check.
Thank you.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [June 16, 2021, 8:21am UTC](https://discuss.elastic.co/t/using-different-index-names-in-output-logstash/273364/6 "2021-06-16T08:21:54Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.